core: handle deserialization errors from FileField migration

[dominic-r]

after migration 0054 changed icon fields from Django FileField to a TextField based custom FileField, old sessions which had serialized Source/Application model instances fail to deserialize.

The old FieldFile descriptors try to access field.storage which no longer exists.

We can't edit that migration since it has already been ran by many/

So, you add AttributeError and TypeError to exception handling in SessionStore.decode() to return an empty session instead of crashing with 500.

Details

REPLACE ME

---

Checklist

• Local tests pass (ak test authentik/)
• The code has been formatted (make lint-fix)

If an API change has been made

• The API schema has been updated (make gen-build)

If changes to the frontend have been made

• The code has been formatted (make web)

If applicable

• The documentation has been updated
• The documentation has been formatted (make docs)

[netlify]

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	36c966c
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-docs/deploys/694ecbac324e9e00080ce6f8
😎 Deploy Preview	https://deploy-preview-19067--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 93.32%. Comparing base (25cae25) to head (36c966c).
⚠️ Report is 45 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
authentik/core/sessions.py	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #19067      +/-   ##
==========================================
- Coverage   93.37%   93.32%   -0.05%     
==========================================
  Files         949      949              
  Lines       52247    52247              
==========================================
- Hits        48786    48760      -26     
- Misses       3461     3487      +26     

Flag	Coverage Δ
conformance	38.83% <0.00%> (+<0.01%)	⬆️
e2e	44.57% <0.00%> (-0.01%)	⬇️
integration	23.38% <0.00%> (-0.06%)	⬇️
unit	91.59% <0.00%> (+<0.01%)	⬆️
unit-migrate	91.64% <0.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-36c966cba406d96cd2cd9d9bf7336718a6026e2e
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-36c966cba406d96cd2cd9d9bf7336718a6026e2e

Afterwards, run the upgrade commands from the latest release notes.

[authentik-automation]

🍒 Cherry-pick to version-2025.12 created: #19168